Root cause (autoscaler pod log, prov #43 chroot):
W orchestrator.go:626 Node group workers is not ready for scaleup -
backoff with status: Scale-up timed out for node group workers after
15m2.273255226s
Hetzner API confirms autoscaler-spawned workers come up PUBLIC-ONLY:
workers-77439321e2047e3e public_net.ipv4=178.105.102.237 private_net=[]
workers-a6410e81b24cced public_net.ipv4=178.105.73.210 private_net=[]
The worker cloud-init (identical to Phase-0 user_data) issues
curl -sfL https://get.k3s.io | K3S_URL=https://10.0.1.2:6443 ... sh -
against the CP's PRIVATE 10.0.1.2 IP. Without the 10.0.0.0/16 attachment
that URL is unreachable → k3s agent install silent-fails → node never
registers with apiserver → autoscaler 15m timeout → backoff → bp-catalyst-
platform Pending Pods never schedulable → chroot canvas tests blocked.
Fix: wire HCLOUD_NETWORK / HCLOUD_FIREWALL / HCLOUD_SSH_KEY env vars on
the cluster-autoscaler deployment so the Hetzner provider attaches every
scale-up VM to the SAME private network + firewall + ssh-key the Phase-0
Tofu module created (resource names: catalyst-<sov-fqdn-with-dashes>-net /
-fw / catalyst-<sov-fqdn-with-dashes>). Names flow:
Tofu (hcloud_network.main.name + hcloud_firewall.main.name +
hcloud_ssh_key.main.name)
→ cloudinit-control-plane.tftpl (3 new template vars)
→ /var/lib/catalyst/cloud-credentials-secret.yaml (3 new keys)
→ flux-system/cloud-credentials Secret
→ bp-cluster-autoscaler-hcloud HelmRelease valuesFrom (3 optional entries
with targetPath: cluster-autoscaler.extraEnv.HCLOUD_*)
→ upstream chart's deployment env
Chart bumped 1.2.0 → 1.3.0. New smoke-test gates (Cases 5+6) prevent
regression of the three env-var slots in chart values.yaml.
Reaffirms canonical seam: values flow through Tofu → cloud-init →
flux-system Secret → Flux valuesFrom → chart values → upstream env.
Never via kubectl patch, never via bespoke Go API calls.
Refs: prov #38/#39/#41/#43 omantel.biz scale-up backoff.
Co-authored-by: e3mrah <1234567+e3mrah@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
b743b646ac